Webhooks

Webhooks are available starting from the Starter plan.

You can send demo alerts to the Webhook URL.

Identifying Leads

There are a few ways in which you can capture or identify leads. You can refer to the article on Lead Tracking to learn more

---

How to Set Up Webhooks inside Alerts

• Go to Settings → Alerts

• Click "Create first Alert"

• Toggle on Webhooks

• Paste your Webhook URL — this is the URL where you want to receive webhook events

• Add Custom headers if needed. Custom headers let you attach extra key-value pairs to every webhook request — useful for passing authentication tokens, routing identifiers, or any metadata your receiving endpoint expects. Click "+ Add header" to add one

• Use Test webhook to confirm everything is working, then hit Save

---

How do I verify the webhook signature?

To ensure that webhook requests are coming from Storylane and have not been tampered with, we recommend verifying the signature included in the request headers.

Every webhook request includes an x-storylane-signature header. This signature is an HMAC-SHA256 hash of the raw request body, generated using your Webhook Verification Secret and then Base64 encoded.

1. Verification Logic

To verify the signature:

1. Retrieve the x-storylane-signature header from the request.

2. Get the raw body of the request (unparsed string).

3. Compute the HMAC-SHA256 hash of the raw body using your Verification Secret as the key.

4. Base64 encode the resulting hash.

5. Compare your generated string with the value in the x-storylane-signature header.

2. Implementation Examples

Node.js (Express)

When using Express, ensure you use the raw body for the HMAC calculation.

const crypto = require('crypto');

app.post('/webhook', (req, res) => {
  const signature = req.headers['x-storylane-signature'];
  const secret = process.env.STORYLANE_WEBHOOK_SECRET;

  // 'req.rawBody' should be the unparsed string of the request body
  const hmac = crypto.createHmac('sha256', secret);
  const digest = hmac.update(req.rawBody).digest('base64');

  if (signature === digest) {
    // Valid signature
    console.log('Webhook verified');
    res.status(200).send('Verified');
  } else {
    // Invalid signature
    res.status(401).send('Unauthorized');
  }
});

Ruby

require 'openssl'
require 'base64'

def verify_signature(payload, secret, received_signature)
  hmac = OpenSSL::HMAC.digest(
    'sha256',
    secret.to_s,
    payload
  )

  expected_signature = Base64.strict_encode64(hmac)

  # Use secure comparison to prevent timing attacks
  Rack::Utils.secure_compare(expected_signature, received_signature)
end

Python (Flask)

import hmac
import hashlib
import base64
from flask import request

@app.route('/webhook', methods=['POST'])
def handle_webhook():
    secret = "your_verification_secret"
    received_signature = request.headers.get('x-storylane-signature')

    # Get raw data
    payload = request.get_data()

    # Create hash
    digest = hmac.new(
        secret.encode('utf-8'),
        payload,
        hashlib.sha256
    ).digest()

    expected_signature = base64.b64encode(digest).decode()

    if hmac.compare_digest(expected_signature, received_signature):
        return "OK", 200
    else:
        return "Unauthorized", 401

---

Webhook Example

To help you understand what kind of data you can expect from our webhooks, here's a sample response payload for unknown and known demo sessions.

Known demo sessions (known lead data)

{
  "id": "a61a8af4-8a33-4b4d-9861-d8542bcb4d36",
  "analytics_url": "https://app.storylane.io/audience/sessions/a61a8af4-8a33-4b4d-9861-d8542bcb4d36",
  "buyer_reveal": {
    "company_name": "Acme Inc",
    "company_domain": "example.com",
    "company_annual_revenue_range": "$1B-$10B",
    "company_employee_range": "1K-5K",
    "confidence_score": "low"
  },
  "checklist_completed": false,
  "completion": 100,
  "cta_opened": null,
  "host_url": "https://app.storylane.io/share/lcmplr8qd0rj",
  "intent_level": "high",
  "lead": {
    "id": "dcc7997a-c811-4778-a065-cc009ad6b46e",
    "client_source": "none",
    "client_tracking_id": null,
    "email": "[e-mail]",
    "first_name": "",
    "last_name": "",
    "lead_source": "Nurtured"
  },
  "link": "https://app.storylane.io/share/lcmplr8qd0rj",
  "link_name": "Default",
  "location": {
    "city": "Pune",
    "country": "India",
    "state": "MH"
  },
  "name": "test for Pardot",
  "referers": [
    "https://app.storylane.io/share/lcmplr8qd0rj?email=[e-mail]"
  ],
  "time_spent": 10,
  "utm_params": {},
  "viewed_at": "2026-05-20T03:27:29.246-07:00",
  "event": "demo_viewed"
}

Unknown demo sessions (unknown lead data)

{
  "id": "b88dce43-555e-454c-82e2-0b5c092a85c0",
  "analytics_url": "https://app.storylane.io/audience/sessions/b88dce43-555e-454c-82e2-0b5c092a85c0",
  "buyer_reveal": {
    "company_name": "Acme Inc",
    "company_domain": "example.com",
    "company_annual_revenue_range": "$1B-$10B",
    "company_employee_range": "1K-5K",
    "confidence_score": "low"
  },
  "checklist_completed": false,
  "completion": 100,
  "cta_opened": null,
  "host_url": "https://app.storylane.io/share/i9k15ivebdkv",
  "intent_level": "high",
  "lead": null,
  "link": "https://app.storylane.io/share/i9k15ivebdkv",
  "link_name": "Default",
  "location": {
    "city": "Pune",
    "country": "India",
    "state": "MH"
  },
  "name": "Test 2 for Marketo",
  "referers": [
    "https://app.storylane.io/share/i9k15ivebdkv",
    "https://app.storylane.io/projects"
  ],
  "time_spent": 3,
  "utm_params": {},
  "viewed_at": "2026-05-20T03:21:32.937-07:00",
  "event": "demo_viewed"
}